Skip to main content

Overview

A Data Feed brings external data into a Workspace so Studio apps can use it. Feeds are built through a dedicated Composer — describe the API in natural language, and Composer scaffolds the request, authentication, pagination, and schema mapping.

Composer-driven

Describe the source in natural language — no API client to wire up by hand

Auth & pagination handled

Bearer tokens, API keys, Basic Auth, OAuth — plus Next Page Link, Cursor, Page Number & Size, and Limit/Offset paging patterns

On-demand or scheduled

Refresh on demand or on Hourly, Every 4 Hours, Daily, Weekly, or Cron schedules

Creating a Data Feed

In Builder Mode, open Connect Data (the database icon in the left rail) and click + New to open the Data Feed editor. The first time you create one you’ll see a 3-step inline tutorial overlay.

Step 1 — Connect to any data source

Data feed tutorial step 1, Connect to any data source: an example prompt asks Composer to connect to the CrowdStrike Falcon API, Composer asks for a Client ID and Secret, and a tip suggests pasting links to API documentation The first step introduces the conversational pattern. A real CrowdStrike example shows:
  • A natural-language prompt: “Connect to our CrowdStrike Falcon API and pull in all managed endpoints with their last-seen status.”
  • Composer’s response asking for the right credentials (Client ID + Secret for OAuth2)
Paste API documentation URLs into your prompts. Composer reads them and produces a more accurate scaffold than working from memory.

Step 2 — Authenticate & Validate

Data feed tutorial step 2, Authenticate & Validate: the Variables panel with client_id (encrypted) and client_secret, and a tip about clicking the lock icon to encrypt sensitive values Composer surfaces a Variables panel where you enter the credentials it asked for. The tip in the editor:
“Click the lock icon next to any sensitive field or credential value to encrypt it. Once encrypted, values are securely stored and never exposed in plain text again.”
Encrypted values are stored in your tenant’s secret store and never echoed back into the Composer chat.

Step 3 — Publish and Enrich

Data feed tutorial step 3, Publish and Enrich: published feeds can be connected to Studio Applications and scheduled to refresh automatically, with an arrow pointing at the Publish button and a Done button
“Published feeds can be connected to Studio Applications and scheduled to refresh automatically.”
Click Done to dismiss the tutorial and arrive in the full editor.

The Data Feed editor

After the tutorial, the editor opens with a blank request flow: Empty data feed editor: a Trigger node set to On Demand, with the note Please publish this data feed in order to trigger a run, a Data Request node with a GET method and an empty URL, and the Composer panel on the right The canvas is a top-down flow of nodes:
  • Trigger — controls when the feed runs
  • Data Request — the primary HTTP request
  • Detail Request (optional) — a secondary request that runs once per ID returned by the primary
You can also drop Notes in between nodes via the + Add Note chips — handy for annotating the flow.

Trigger node

The Trigger controls refresh cadence: When set to On Schedule, a Type dropdown appears: Trigger type dropdown showing five schedule options: Hourly, Every 4 Hours, Daily, Weekly, and Cron

Data Request node

The primary request. Pick an HTTP method and a URL: HTTP method dropdown showing GET (selected), POST, PUT, DELETE, PATCH, HEAD, and OPTIONS Add optional sections from the + chips below the URL row. The full set is: A typical configured Data Request looks like: Data Request for the CISA Known Exploited Vulnerabilities feed with Authorization (None), Pagination (None), Data Path vulnerabilities and ID Path cveID, add chips for Headers, Params and Body, and a 200 OK test response on the right
Adding sections. A fresh Data Request shows the method picker, URL field, and a single + Add button. Use + Add to attach Headers, Authorization, Pagination, Params, Body, Data Path, ID Path, or Capture Variables. The × button on any added section removes it.

Authorization options

Authorization dropdown showing None (selected), Basic Auth, Bearer Token, API Key, and Inherit from parent

Pagination patterns

Pagination dropdown showing None (selected), Next Page Link, Cursor, Page Number & Size, and Limit/Offset

Detail Request node (optional)

Use a Detail Request when the primary endpoint returns a list of IDs and you need per-record data from a second endpoint: Data feed editor for CISA Known Exploited Vulnerabilities with Trigger, Data Request and Detail Request nodes: the Detail Request has a GET method, a URL placeholder https://api.example.com/data/{{id}} that uses the id captured by the Data Request, and an Add button The Detail Request URL can interpolate any variable captured by the primary request — by default it’s {{id}} (from the ID Path). You can also expose more captured variables via the Capture Variables section on the primary request. This is the classic “list + detail” pattern — fetch a list of object IDs, then fetch each object’s full payload.

Test panel

Below the request canvas, the Test button runs the full Data Feed end-to-end against your live credentials and shows the response inline — status code, headers, payload preview. Use this to validate before publishing. The test runs against your Draft version. Test failures don’t affect Published feeds in any way.

The Data Feed ⋯ menu

The ⋯ icon at the top-right of the Data Feed editor reveals:

Advanced submenu

Deleting a Data Feed is destructive. Studio apps wired to it will stop working until they’re either pointed at a different Feed or have the Feed re-imported. Confirm twice.

Where Feeds appear

After publishing, a Feed shows up in:
  • The Data Feeds counter on the workspace overview
  • The Data Feeds tab in the left rail (database icon)
  • The Data sources picker inside the Studio editor when building an app
Data page in a new workspace: No data feeds yet with a Create your first data feed button, a Gallery of ready-made data feeds such as SentinelOne agents and Okta identity, and the Planner on the right

Explore further

Data Sources

Common source patterns: REST APIs, OAuth2, file-based, webhooks

Schema & Fields

How Composer infers the schema and how to refine it

Sync & Freshness

Schedules, on-demand refresh, and troubleshooting stale data
Privacy: When using Data Feeds with the Studio Composer, the AI only sees the schema (field names, types) — never your actual data values. See Security & Privacy.